Anti-cheat is moving from stopping cheats to reading behavior

The old picture of cheating is someone tampering with game files. Guy Kroupp, founder of GetGud, argues that picture is out of date, and that anti-cheat built to catch tampering misses a growing class of cheats entirely. On Player Driven, he explained why AI aimbots change the equation, why he thinks the way to catch cheating is to read player behavior, and where client-side anti-cheat still belongs. His figures are his own, and GetGud sells server-side detection, so treat the claims as one operator's view.

Cheating started as a text file and became an industry

Kroupp traces cheating back to the 1990s, when a single-player game kept its numbers in an INI file and anyone could open it and give themselves more gold. Nobody minded, he says, because it was your game. Multiplayer changed that, because a cheater now affects other people.

In his account, players cheat in multiplayer games in two ways. They can read the game's memory to get information they should not have, such as where enemies are behind a wall, or they can write to it or change game files, which covers speed hacks and aim snaps. Client-side anti-cheat sits on the player's machine and looks for exactly those two things.

The weakness, he says, is where that code lives. It runs on the cheater's machine, so they can study it and need to beat it only once. Each side patches in response, which is the arms race the industry keeps describing. Kroupp calls the cheat business a multibillion-dollar market, though he declines to stand behind a specific company figure.

Why kernel-level anti-cheat is a risky answer

When client-side tools moved into the operating system's kernel mode, Kroupp says, cheat makers followed. He describes cheats that start when a computer boots and devices that pose as legitimate hardware, with anti-cheat then chasing them in turn. Moving to the kernel made life harder for cheat makers, he says, but did not change the cat-and-mouse pattern.

It also raises a security question. Kernel access means nothing can stop the software, he notes, so if the game is ever hacked, an attacker gets that access on every player's machine. Greg Posner added that players already push back on anti-cheat that reaches as deep as the motherboard.

An AI aimbot never touches the game

The cheat Kroupp worries about most does not hack the game at all. An AI aimbot reads a picture of the screen, finds the silhouettes of enemies, and moves the mouse to snap to a head and fire. It does not read game memory, change a file or break any rule a client-side tool is watching for.

That is why, in his view, a client-side tool cannot find it by design, and why the problem is growing as these tools become faster and more common. His point is narrow and technical: if nothing on the player's machine was altered, there is nothing on the machine to detect.

Server-side detection works like a prosecutor, not a cop

A multiplayer game's server already receives every movement, attack, damage event, position and line of sight. Kroupp says server-side anti-cheat collects that stream and reconstructs the match without graphics, a digital twin of what happened, then judges the behavior afterward.

He is explicit about the tradeoff. A cop tries to stop a crime as it happens. A prosecutor reviews the recording. Server-side detection does not stop a cheater mid-match, so he argues for layers: client-side tools to add friction, and server-side review to catch what gets through.

What it can see is behavior that breaks the game's own physics, he says. Speed beyond what the game allows, aim that tracks enemies through walls, rapid fire and ammo abuse are simple rules. Weapon kill cones, the angle a shot should be able to land at a given distance, catch hits that are too accurate. Aim snaps show up as smooth human movement followed by a straight line. Kroupp estimates that about 80% of cheats fall into the simple-rule group, a figure he gives as his own.

Closet cheaters are the limit

Kroupp does not claim the problem is solved. A skilled player who cheats with tiny corrections, millimeters rather than a centimeter, is very hard to tell from a very good player, and Posner pressed that point, asking at what point it is simply skill. Kroupp agrees those cases can slip through.

His position is that the arms race is over on the server side, but that closet cheaters may still get away. He argues they are a small share of cheating and do not drive the churn that hurts a game. He puts the cost of unchecked cheating at 15 to 20% player churn and says one cheater in a 40-player match can ruin it. Both are his figures, not independent data.

What a flagged NPC taught one studio

One of the more useful stories in the episode is a false positive. In a game still in development, the system flagged an NPC as using an aimbot. The cause was not cheating. The studio was sending yaw but not pitch for its NPCs, so the aim data looked impossible.

Kroupp says the lesson is that false positives often point to a problem in the data a studio is sending, which makes the detection useful for debugging as well as for banning.

What it takes for a studio to start

Kroupp says the approach fits any 2D or 3D game where players move and fight, and rests on seven actions he calls the primal seven: spawn, death, attack, damage, position, heal and effect. He says connecting a game used to take a week to a month, and that with an AI agent and GetGud's SDK it can now take about an hour.

He also pitches observability as a second benefit. The same data can flag griefing such as AFK players, camping or spawn-killing, and show which weapons, characters and areas players use, so a studio can see how its game is actually played. GetGud also exposes this data to AI tools through an MCP server, and he says the company wants to make it free for very small, vibe-coded indie teams.

Where to find Guy and GetGud

GetGud is at getgud.io. For another view on how anti-cheat is shifting toward behavior, hear our earlier conversation with Anybrain's Andre Pimenta on the AI and cheating episode.

Keep going

Hear the whole conversation on the full episode, then get the next one in your inbox with The Operator's Briefing and join the discussion in the Player Driven Discord.